Pith. sign in

REVIEW 5 major objections 6 minor 59 references

Flow-Based Detection and Identification of Zero-Day IoT Cameras

T0 review · 5 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that flow statistics alone, without IP addresses, ports, or decryption, can identify known IoT cameras with over 99% accuracy and flag unseen zero-day cameras as outliers.

desk verdict Known-camera identification is solid and useful, but the zero-day claim is undermined by target-aware feature selection and inconsistent numbers. read the letter →

arxiv 2509.08485 v1 pith:5L6WSA75 submitted 2025-09-10 cs.CR

Priyanka Rushikesh Chaudhary , Rajib Ranjan Maiti This is my paper · ORCID
classification cs.CR
keywords IoTcameradetectionzero-dayflow-basedfeaturesone-classclassificationDeepSVDDXGBoostnetworktrafficoutlier
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to solve a practical problem for network administrators: detecting that a streaming IoT camera has joined a network, even when the camera model has never been seen before. It proposes zCamInspector, which turns captured traffic into flow-level statistics and runs two kinds of models: supervised classifiers that name a known camera, and one-class classifiers that treat any unseen camera as an outlier against ordinary non-camera traffic. On eleven cameras plus conferencing and video-sharing applications, the paper reports that XGB identifies known cameras with more than 99% accuracy and a false-negative rate as low as 0.3%. For zero-day cameras, it reports detection accuracy up to 96.55% and identifies DeepSVDD as the most consistent one-class detector when all test cameras are new. If these results hold, camera presence can be inferred from generic flow statistics, without decrypting traffic or relying on IP addresses or ports.

What carries the argument

The mechanism that carries the argument is the per-flow feature vector: 62 bidirectional flow statistics such as packet lengths, flag counts, inter-arrival times, window sizes, and throughput ratios, reduced to the ten most important features by an ExtraTree classifier. The same ten features feed both the supervised camera-identity model and the one-class zero-day detectors. The one-class models learn a boundary around ordinary non-camera traffic; DeepSVDD does this by mapping flows into a low-dimensional latent space and enclosing normal traffic in a minimal hypersphere, so a flow from a never-seen camera lands outside the boundary and is flagged as an outlier.

What would settle it

Re-run the zero-day pipeline with feature selection performed on the non-camera training split only, holding out all camera flows until testing; if the mean DeepSVDD testing accuracy falls well below the reported 74.51%, the optimistic estimate caused by target-aware feature selection is confirmed.

Watch

Extended reading notes

Core claim

The central claim is that streaming IoT cameras leave a distinguishable trace in generic flow statistics, and that an unseen camera can be detected as an outlier by a one-class model trained purely on non-camera traffic. zCamClassifier, using XGB, identifies each known camera with over 99% accuracy in the combined dataset; zCamDetector, using DeepSVDD, learns a hypersphere around non-camera flows in a latent space and reports strong zero-day detection, with a mean testing accuracy of 74.51% when every test camera is unseen. The system deliberately avoids IP addresses and transport ports, so it is agnostic to NAT and to cameras that share cloud infrastructure with ordinary applications.

Load-bearing premise

The load-bearing premise is that features chosen after looking at both camera and non-camera traffic can still measure how well a system detects cameras it has never seen; if feature selection is the part that leaks information about the target class, the zero-day results are inflated.

Editorial extensions

If this is right

  • A network administrator could be alerted the first time an unseen camera streams, without a vendor whitelist or prior knowledge of the device.
  • Because detection uses flow statistics only, it works on encrypted traffic and behind NAT, as long as the router or switch can mirror packets.
  • The same ten features serve both identification and zero-day detection, so deployment could sit at a gateway with modest computing resources.
  • If the method transfers to other streaming IoT devices, such as doorbells and baby monitors, the same outlier framework could flag them without retraining on each model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The reported zero-day accuracy is probably optimistic because the top-ten features were selected by a classifier that saw both the non-camera and camera classes; retraining the feature selector on the non-camera training data alone would give a fairer estimate.
  • The most confusing traffic is likely other continuous video streams, such as conferencing and video-sharing applications; a stress test would pit cameras against long, high-bitrate video calls to see how much of the outlier signal remains.
  • The same flow-feature design could plausibly detect other streaming IoT devices, but the paper only claims cameras; testing on doorbells, baby monitors, and smart displays would be a natural extension.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes zCamInspector, a system for identifying known IoT cameras with supervised classifiers (zCamClassifier) and detecting zero-day IoT cameras with one-class classifiers (zCamDetector), using flow-based features extracted with CICFlowmeter and avoiding IP addresses and transport ports. The authors use about 40 GB of traffic: Set I from six commercial cameras in their own laboratory, Set II from five open-source cameras (UNSW dataset), and Set III from non-camera video-conferencing and video-sharing applications. They evaluate seven supervised models and four one-class models, reporting that XGB achieves over 99% accuracy for known camera identification and that one-class detectors achieve zero-day accuracies of 93.20% (OCSVM), 96.55% (SGDOCSVM), 78.65% (Isolation Forest), and 92.16% (DeepSVDD) when trained on Set III and tested on Sets I and II. The paper also reports a scenario where all eleven cameras are treated as zero-day, with DeepSVDD giving a mean testing accuracy of 74.51%.

Significance. If the zero-day detection results were valid, the paper would make a useful contribution to IoT security, and the release of a new IoT camera traffic dataset (BITSPHC) would benefit the community. The paper is also commendable for making part of the code and sample traces available. However, the central zero-day claim is not established by the current evaluation: the feature selection step uses the labels of the 'unseen' camera class, the headline zero-day accuracies in the abstract conflict with the numbers in Table 5, a key all-zero-day result is actually the mean of a different experimental scenario, and hyperparameters appear to have been tuned against the test class. These issues jointly invalidate the paper's main contribution as reported.

major comments (5)
  1. [§5.1, §5.5] The zero-day evaluation is not blind because the top-10 feature subset is selected using labels from both 'Others' (Set III) and 'IoTCam' (Set I and Set II). Section 5.1 explicitly states that the ExtraTree classifier is trained on two classes, 'Others' and 'IoTCam', and Section 5.5 trains every one-class detector on Set III using exactly these top-10 features. Since the feature selection step has already seen the labels of the cameras that are supposed to be unseen, the detector is evaluated on features known to discriminate the test class from the training class. Figure 3(b) confirms that the two-class ExtraTree separates these classes almost perfectly, so the selected features are strongly informative for the target class by construction. The reported zero-day accuracies in Table 5 and the abstract are therefore optimistically biased and do not estimate performance on genuinely unseen camera traffic. To support the zero-day claim, feature selection must be performed using only the training-class data (e.g., Set III only) or with an unsupervised method applied before any camera labels are used.
  2. [Abstract, §5.5] The abstract reports zero-day accuracies of 93.20%, 96.55%, 78.65%, and 92.16% for OneClassSVM, SGDOneClassSVM, IsolationForest, and DeepSVDD when trained on Set III and tested on Set I and Set II. Table 5, however, reports the mean testing accuracies on Set I & Set II as 27.2%, 19.7%, 14.35%, and 98.17% for the same models and the same training condition. These numbers are mutually inconsistent; for example, the abstract's 92.16% for DeepSVDD does not match Table 5's 98.17%, and the abstract's 93.20% for OneClassSVM is far from Table 5's 27.2%. The authors must clarify which set of numbers is correct, define the exact metric used (e.g., outlier detection rate versus classification accuracy), and reconcile the abstract with the experimental tables.
  3. [§5.6, Abstract] The abstract and conclusion state that when all IoT cameras are zero-day, DeepSVDD achieves a mean testing accuracy of 74.51%. This value is, in fact, the mean of the 11 testing accuracies in Table 6, which is the 'All But one Zero Day' scenario where each model is trained on the flows of exactly one known camera and tested on the remaining ten cameras. The true all-zero-day scenario of Section 5.5 trains on Set III and tests on Set I and Set II, for which Table 5 reports a DeepSVDD mean testing accuracy of 98.17%. The reported 74.51% is therefore attributed to the wrong experimental setting, and the claim that DeepSVDD is best when all devices are zero-day is not supported by the cited number.
  4. [§5.5, Fig. 10] The hyperparameters of the one-class models appear to have been tuned against the test class. Section 5.5 states that the number of outliers is shown 'by tuning different hyperparameter in Fig. 10 indicating maximum outliers in IoTCam class.' If the final hyperparameter choices (Table 3) were selected by maximizing outlier detection on the IoTCam test set, then the test set has influenced model selection, further invalidating the zero-day evaluation. The authors should specify how the hyperparameters were chosen, and they must use a validation set drawn from the training distribution or fix hyperparameters a priori before any contact with the zero-day class.
  5. [§6.1, Table 8] The supervised classification results, which support the secondary claim that XGB identifies known cameras with over 99% accuracy, are reported as single 'Maximum Accuracy' values without cross-validation, confidence intervals, or multiple runs. This makes it impossible to assess whether the differences among models (e.g., XGB versus Random Forest) are statistically meaningful or whether the reported numbers are sensitive to the train/test split. The authors should provide cross-validated results with standard deviations, especially because the comparison with prior work (Section 6.3) relies on these point estimates.
minor comments (6)
  1. [§3.4.1] The text says CICFlowmeter extracts 77 flow-based features, while the abstract and Section 1 state 62 features; these numbers should be reconciled.
  2. [§1] The section heading in the introduction is printed as 'SySetm Design and Implementation'; this appears to be a typo for 'System'.
  3. [§6.1] The ROC curve described in the text is referenced as 'Fig.??'; the figure reference is missing and should be fixed.
  4. [§5.6] Table 6 contains two rows labeled 'Netatmo: 10 IoT Cams.' with different testing accuracies, which is confusing because one Netatmo belongs to Set I and the other to Set II; the rows should be labeled distinctly (e.g., Netatmo (BITSPHC) and Netatmo (UNSW)).
  5. [§5.5] The evaluation protocol for Table 5 is not fully specified: the paper states that 90% of Set III is used for training and 10% for testing, but the details of how the standard scaler is fitted and whether the Set I/II test data undergo the same preprocessing are not described; these details should be stated explicitly.
  6. [§6.3] The comparison in Figure 12 reports TPR and FPR for zCamInspector, DeWiCam, and SCamF, but the text does not explain how the zCamInspector TPR/FPR values were obtained or under which test scenario they were measured; this should be clarified.

Circularity Check

2 steps flagged · score 6.0 of 10

Zero-day detection claim is not blind: feature selection and hyperparameter tuning use the IoTCam test class, so the reported zero-day accuracies are fitted; supervised camera identification remains independent.

  1. fitted input called prediction [Section 5.1 (Feature Selection using ExtraTree Model), Section 5.5 (Zero-Day IoT Camera using One-Class Models), Fig. 3]
    "In this paper, we consider two classes, "Others", i.e., Set III, and "IoTCam", i.e., the combined set of Set I and Set II, for selecting the features using this classifier. ... Thus, assuming that a network administrator has not seen any traffic from any of the IoT Cameras, A model in zCamDetector is trained only with Set III."

    The one-class detectors are presented as zero-day predictors trained only on non-IoT traffic, but the 10 features they use are selected by an ExtraTree classifier fit to distinguish Others from IoTCam, where IoTCam is exactly the set of 'unseen' cameras (Set I + Set II) used for testing. The test-class labels therefore enter the pipeline before any one-class model is trained, and Fig. 3(b) shows the two classes are almost perfectly separable (misclassification 0.0025%), so the chosen features are known to be discriminative for the target class. Reporting accuracy on those same cameras as zero-day detection is an in-sample, leakage-affected estimate rather than a blind prediction.

  2. fitted input called prediction [Section 5.5, Fig. 10, Table 3]
    "We shows the number of outliers in OCSVM, SGDOCSVM and IF by tuning different hyperparameter in Fig. 10 indicating maximum outliers in IoTCam class."

    The hyperparameters reported in Table 3 (OCSVM nu=0.001, gamma=0.999; IF contamination=0.1; etc.) are selected by inspecting how many IoTCam test-flow outliers each configuration produces, i.e., by optimizing against the very class that is supposed to be unseen at deployment. Tuning a detector to maximize outliers on the target test set makes the resulting zero-day accuracy a fitted number, not an estimate of performance on genuinely unseen cameras.

full rationale

The paper's supervised identification result (XGB >99% accuracy on Set I, Set II, and Combined) is a standard classification evaluation with train/test separation and is not circular; it stands independently of the zero-day experiments. The zero-day contribution, however, is evaluated with test-label leakage. Section 5.1 selects the top-10 features using an ExtraTree classifier trained on Others versus IoTCam, where IoTCam is the combined Set I + Set II test set; Section 5.5 then trains all one-class detectors on Set III only but feeds them those 10 features, so the 'unseen' camera labels have already influenced the detector's input representation. Section 5.5 also tunes hyperparameters against the number of outliers found in the IoTCam test class (Fig. 10). Both practices make the reported zero-day accuracies optimistic and partly fitted to the target data. The abstract's zero-day accuracy figures (93.20%, 96.55%, 78.65%, 92.16%) also do not match the Set I & Set II testing means in Table 5 (27.2%, 19.7%, 14.35%, 98.17%), an inconsistency that further weakens confidence in the reported headline numbers, though it is a reporting/correctness issue rather than circularity. Self-citations to iCamInspector are used as a baseline and are not load-bearing for the central derivation, so they do not raise the score. Overall, the known-camera identification claim is self-contained, but the flagship zero-day detection claim reduces in part to a feature-selection and hyperparameter-tuning process that already saw the test class, warranting a partial-circularity score of 6.

Assumptions & free parameters 8 free parameters · 4 assumptions · 0 invented entities

The system introduces no new physical or mathematical entities. All tunable hyperparameters are listed and hand-set; the most consequential choice is the supervised feature subset, which is selected on both classes and then used in the one-class zero-day evaluation.

free parameters (8)
  • OCSVM nu = 0.001
    Hand-set boundary tightness; no validation set described.
  • OCSVM gamma = 0.999
    Hand-set RBF kernel sensitivity.
  • SGDOCSVM nu = 0.03
    Hand-set fraction of anomalies allowed.
  • SGDOCSVM eta0 = 0.0001
    Hand-set learning rate.
  • IsolationForest contamination = 0.1
    Hand-set expected outlier fraction.
  • DeepSVDD threshold = 95
    Hand-set distance threshold for flagging anomalies.
  • DeepSVDD architecture and training = hidden=512, latent=8, lr=0.0001, epochs=150
    Hand-set network capacity and training schedule.
  • Top-10 feature subset = 10 features from ExtraTree importance
    Selected with supervision on both Others and IoTCam classes, which leaks target information into the zero-day evaluation.
assumptions (4)
  • domain assumption CICFlowmeter flow statistics capture device-specific behavior independent of IP addresses and ports.
    The entire system relies on these generic flow features being sufficient to separate cameras from other applications.
  • domain assumption Set III ('Others') is representative of all legitimate non-camera traffic a defender will see.
    One-class models are trained only on Set III and must reject all unseen legitimate flows to avoid false alarms.
  • domain assumption The 11 cameras in Set I and Set II span the behavioral space of IoT cameras.
    The zero-day generalization claim extends from these 11 devices to any unseen camera.
  • ad hoc to paper Features selected using both normal and camera classes are still valid for evaluating a detector trained only on normal data.
    Implicit in Sections 5.1 and 5.5; this assumption is false and inflates the reported zero-day results.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Flow-Based Detection and Identification of Zero-Day IoT Cameras." pith.science (2026). https://pith.science/paper/5L6WSA75

@misc{pith2026250908485,
  author       = {Pith},
  title        = {Pith review of: Flow-Based Detection and Identification of Zero-Day IoT Cameras},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5L6WSA75}},
  note         = {Machine review of arXiv:2509.08485}
}
read the original abstract

The majority of consumer IoT devices lack mechanisms for administrators to monitor and control them, hindering tailored security policies. A key challenge is identifying whether a new device, especially a streaming IoT camera, has joined the network. We present zCamInspector, a system for identifying known IoT cameras with supervised classifiers (zCamClassifier) and detecting zero-day cameras with one-class classifiers (zCamDetector). We analyzed ~40GB of traffic across three datasets: Set I (six commercial IoT cameras), Set II (five open-source IoT cameras, ~1.5GB), and Set III (four conferencing and two video-sharing applications as non-IoT traffic). From each, 62 flow-based features were extracted using CICFlowmeter. zCamInspector employs seven supervised models (ET, DT, RF, KNN, XGB, LKSVM, GNB) and four one-class models (OCSVM, SGDOCSVM, IF, DeepSVDD). Results show that XGB identifies IoT cameras with >99% accuracy and false negatives as low as 0.3%, outperforming state-of-the-art methods. For zero-day detection, accuracies reached 93.20% (OCSVM), 96.55% (SGDOCSVM), 78.65% (IF), and 92.16% (DeepSVDD). When all devices were treated as zero-day, DeepSVDD performed best with mean training/testing accuracies of 96.03%/74.51%. zCamInspector also achieved >95% accuracy for specific devices, such as Spy Clock cameras, demonstrating its robustness for identifying and detecting zero-day IoT cameras in diverse network environments.

Figures

Figures reproduced from arXiv: 2509.08485 by the authors.

Figure 1
Figure 1. A motivating example. of IoT device in general and IoT cameras in particular. First, is it possible to identify the network flows of a particular IoT (spy) camera in an IoT network for better inventory management? Second, is it possible to detect an IoT camera whose flow patterns are not known apriori, i.e., zero-day IoT camera, in the presence of network flows arising from online audio/video conferencing, like Meet… view at source ↗
Figure 2
Figure 2. Architecture of our proposed system zCamInspector. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Performance of ExtraTree model in feature selection having two classes as [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: Anomaly detection using PCA in Others (Class 0) and IoTCam (Class 1). [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Best Component using BIC and GMM shows PCA-reduced two features with the inliers and out￾liers when 95 percentile is considered as threshold, resulting roughly 5% of the samples in Set III as outliers. Applying on Fz, the same GMM finds 5% (1188 out of 119932) of outli…
Figure 6
Figure 6. Figure 6: Anomaly detection using GMM in Others (Class 0) and IoTCam (Class 1). [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Plot of the training samples from "Others" class, where each of the three models, i.e., ocsvm, sgdocsvm and iso-forest, [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Plot of test samples of "Others" class, where each of the three models, i.e., ocsvm, sgdocsvm and iso-forest, is trained [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 9
Figure 9. Figure 9: Plot of the test samples from "IoTCam" dataset, where each of the three models, i.e., ocsvm, sgdocsvm and iso-forest, [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 10
Figure 10. Figure 10: Outlier detection by tuning different parameters using one class classification models. [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]
Figure 11
Figure 11. Figure 11: Others and IoTCam datasets RoC and Precision [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]
Figure 12
Figure 12. Figure 12: Comparison of zCamInspector with Existing Work [PITH_FULL_IMAGE:figures/full_fig_p014_12.png]
Figure 13
Figure 13. Figure 13: Modules of zCamInspector The feature selector module is essential in zCamInspec￾tor due to the varying requirements of the models. Our analysis shows that the detection of zero-day IoT cameras can be done based on most important ten features. Note that the clustering …

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 54 canonical work pages

  1. [1]

    Global smart cameras market overview,

    M. R. Future, “Global smart cameras market overview,” https://www.marketresearchfuture.com/reports/ smart-cameras-market-1326, 2024

    work page 2024

  2. [2]

    Smart cameras market,

    S. Research, “Smart cameras market,” https://straitsresearch. com/report/smart-cameras-market, 2023

    work page 2023

  3. [3]

    Voices of first responders—nationwide public safety com- munication survey methodology: Development, dissemination, and demographics,

    K. K. Greene, S. Dawkins, S. S. Prettyman, P . Konkol, M. F. Theofanos, K. Mangold, S. Furman, Y.-Y. Choong, and M. P . Steves, “Voices of first responders—nationwide public safety com- munication survey methodology: Development, dissemination, and demographics,” https://nvlpubs.nist.gov/nistpubs/ir/2020/ NIST.IR.8288.pdf, 2020

    work page 2020

  4. [4]

    Con- siderations for managing internet of things (iot) cybersecurity and privacy risks,

    K. Boeckl, M. Fagan, W. Fisher, N. Lefkovitz, K. N. Megas, E. Nadeau, D. G. O’Rourke, B. Piccarreta, and K. Scarfone, “Con- siderations for managing internet of things (iot) cybersecurity and privacy risks,” https://nvlpubs.nist.gov/nistpubs/ir/2019/NIST. IR.8228.pdf, 2019

    work page 2019

  5. [5]

    Signature-based and behavior-based attack detection with machine learning for home iot devices,

    Vasaka Visoottiviseth and Pranpariya Sakarin and Jetnipat Thongwilai and Thanakrit Choobanjong, “Signature-based and behavior-based attack detection with machine learning for home iot devices,” in Proc. of IEEE Region 10 Conference, 2020, pp. 829– 834

    work page 2020

  6. [6]

    Network intrusion detection for iot security based on learning techniques,

    Chaabouni, Nadia and Mosbah, Mohamed and Zemmari, Akka and Sauvignac, Cyrille and Faruki, Parvez, “Network intrusion detection for iot security based on learning techniques,” IEEE Communications Surveys & Tutorials, vol. 21, no. 3, pp. 2671– 2701, 2019

    work page 2019

  7. [7]

    Snort: Lightweight intrusion detec- tion for networks

    Roesch, Martin and others, “Snort: Lightweight intrusion detec- tion for networks.” in Lisa, vol. 99, no. 1, 1999, pp. 229–238

    work page 1999

  8. [8]

    Suricata open source ids/ips/nsm engine (2019)

    Open Information Security Foundation, “Suricata open source ids/ips/nsm engine (2019).” https://suricata-ids.org/

    work page 2019

Show all 59 references
  1. [9]

    Canary Case Study,

    AWS, “Canary Case Study,” https://aws.amazon.com/solutions/ case-studies/canary/, 2015

    2015

  2. [10]

    An iot analysis framework: An inves- tigation of iot smart cameras’ vulnerabilities,

    D. Alharbi R.and Aspinall, “An iot analysis framework: An inves- tigation of iot smart cameras’ vulnerabilities,” 2018

    2018

  3. [11]

    Testing iot security: The case study of an ip camera,

    Abdalla Peshraw Ahmed and Varol Cihan, “Testing iot security: The case study of an ip camera,” in International Symposium on Digital Forensics and Security (ISDFS), 2020, pp. 1–5

    2020

  4. [12]

    Investigating security and privacy of a cloud-based wireless ip camera: Netcam,

    Tekeoglu, A. and Tosun, A. S., “Investigating security and privacy of a cloud-based wireless ip camera: Netcam,” in 24th International Conference on Computer Communication and Networks. IEEE, 2015, pp. 1–6

    2015

  5. [13]

    Security analysis of emerg- ing smart home applications,

    E. Fernandes, J. Jung, and A. Prakash, “Security analysis of emerg- ing smart home applications,” in IEEE symposium on security and privacy, 2016, pp. 636–654

    2016

  6. [14]

    Classifying iot devices in smart environments using network traffic characteristics,

    Sivanathan, A. and H. Gharakheili and L. Franco and Radford, A. and Wijenayake, C. and Vishwanath, A.and Sivaraman, V ., “Classifying iot devices in smart environments using network traffic characteristics,” IEEE Transactions on Mobile Computing, pp. 1–1, 08 2018

    2018

  7. [15]

    Iothunter: Iot net- work traffic classification using device specific keywords,

    P . Khandait, N. Hubballi, and B. Mazumdar, “Iothunter: Iot net- work traffic classification using device specific keywords,” IET Networks, 2021

    2021

  8. [16]

    Led light bulb camera wireless ip cctv camera fisheye panoramic view, p2p, 5mp ultra hd,

    Unitoptek, “Led light bulb camera wireless ip cctv camera fisheye panoramic view, p2p, 5mp ultra hd,” https://homesecure.shop/ products/

  9. [17]

    Characterizing smart home iot traffic in the wild,

    M. H. Mazhar and Z. Shafiq, “Characterizing smart home iot traffic in the wild,” CoRR, vol. abs/2001.08288, 2020

    2001 arXiv

  10. [18]

    icamin- spector: Classify video traffic and detect iot (spy) camera flows,

    J. C. Priyanka Rushikesh Chaudhary and R. R. Maiti, “icamin- spector: Classify video traffic and detect iot (spy) camera flows,” in International Conference on Building a Secure & Empowered Cyberspace (BuildSec). IEEE, 2024

    2024

  11. [19]

    icaminspector,

    P . R. Chaudhary and R. R. Maiti, “icaminspector,” https://github. com/priyankarushikesh/iCamInspector, 2024

    2024

  12. [20]

    Cicflowmeter-v4.0 (formerly known as is- cxflowmeter) is a network traffic bi-flow generator and analyser for anomaly detection,

    A. Habibi Lashkari, “Cicflowmeter-v4.0 (formerly known as is- cxflowmeter) is a network traffic bi-flow generator and analyser for anomaly detection,” 08 2018

    2018

  13. [21]

    zcaminspector,

    P . R. Chaudhary and R. R. Maiti, “zcaminspector,” https://github. com/priyankarushikesh/zCamInspector, 2024

    2024

  14. [22]

    Are there wireless hidden cameras spying on me?

    J. Heo, S. Gil, Y. Jung, J. Kim, D. Kim, W. Park, Y. Kim, K. G. Shin, and C.-H. Lee, “Are there wireless hidden cameras spying on me?” in Proceedings of the 38th Annual Computer Security Applications Conference, 2022, pp. 714–726

    2022

  15. [23]

    Dewicam: Detecting hidden wireless cameras via smartphones,

    Y. Cheng, X. Ji, T. Lu, and W. Xu, “Dewicam: Detecting hidden wireless cameras via smartphones,” ser. ASIACCS, 2018, p. 1–13. [Online]. Available: https://doi.org/10.1145/3196494.3196509

    2018

  16. [24]

    Iot-praetor: Undesired behaviors detection for iot devices,

    J. Wang, S. Hao, R. Wen, B. Zhang, L. Zhang, H. Hu, and R. Lu, “Iot-praetor: Undesired behaviors detection for iot devices,” IEEE Internet of Things Journal, vol. 8, no. 2, pp. 927–940, 2021

    2021

  17. [25]

    The decoyport: Redirecting hackers to honeypots,

    Kim, Iksu and Kim, Myungho, “The decoyport: Redirecting hackers to honeypots,” in Network-Based Information Systems. Berlin, Heidelberg: Springer Berlin Heidelberg, 2007, pp. 59–68

    2007

  18. [26]

    Siphon: Towards scalable high-interaction physical honeypots,

    Guarnizo, Juan David and Tambe, Amit and Bhunia, Suman Sankar and Ochoa, Martin and Tippenhauer, Nils Ole and Shabtai, Asaf and Elovici, Yuval, “Siphon: Towards scalable high-interaction physical honeypots,” in Proc. of the 3rd ACM Workshop on Cyber-Physical System Security, 2...

    2017

  19. [27]

    Detecting hidden wireless cameras through network traffic analysis,

    Cowan, KC, “Detecting hidden wireless cameras through network traffic analysis,” Ph.D. dissertation, Virginia Tech, 2020

    2020

  20. [28]

    Homonit: Monitoring smart home apps from encrypted traffic,

    W. Zhang, Y. Meng, Y. Liu, X. Zhang, Y. Zhang, and H. Zhu, “Homonit: Monitoring smart home apps from encrypted traffic,” in ACM SIGSAC, 2018

    2018

  21. [29]

    Toward detecting iot device traffic in tran- sit networks,

    G. Hu and K. Fukuda, “Toward detecting iot device traffic in tran- sit networks,” in International Conference on Artificial Intelligence in Information and Communication, 2020, pp. 525–530

    2020

  22. [30]

    Can we classify an iot device using tcp port scan?

    Sivanathan, Arunan and Gharakheili, Hassan Habibi and Sivara- man, Vijay, “Can we classify an iot device using tcp port scan?” in IEEE International Conference on Information and Automation for Sustainability, 2018, pp. 1–4

    2018

  23. [31]

    Securing smart homes via software-defined networking and low-cost traffic classifica- tion,

    Gordon, Holden and Batula, Christopher and Tushir, Bhagyashri and Dezfouli, Behnam and Liu, Yuhong, “Securing smart homes via software-defined networking and low-cost traffic classifica- tion,” in IEEE Annual Computers, Software, and Applications Conference, 2021, pp. 1049–1057

    2021

  24. [32]

    Uncovering vulnerable industrial control systems from the internet core,

    M. Nawrocki, T. C. Schmidt, and M. Wählisch, “Uncovering vulnerable industrial control systems from the internet core,” in IEEE/IFIP Network Operations and Management Symposium, 2020, pp. 1–9

    2020

  25. [33]

    Smart lamp or security camera? automatic identification of iot devices,

    M. D. Thomsen, A. Giaretta, and N. Dragoni, “Smart lamp or security camera? automatic identification of iot devices,” in International Networking Conference. Springer, 2020, pp. 85–99

    2020

  26. [34]

    A framework for mitigating zero-day attacks in iot,

    V . Sharma, J. Kim, S. Kwon, I. You, K. Lee, and K. Yim, “A framework for mitigating zero-day attacks in iot,” arXiv preprint arXiv:1804.05549, 2018. 18

    2018 arXiv

  27. [35]

    Diot: A federated self-learning anomaly de- tection system for iot,

    T. D. Nguyen, S. Marchal, M. Miettinen, H. Fereidooni, N. Asokan, and A.-R. Sadeghi, “Diot: A federated self-learning anomaly de- tection system for iot,” in 2019 IEEE 39th International conference on distributed computing systems (ICDCS). IEEE, 2019, pp. 756– 767

    2019

  28. [36]

    Zero day threat detection using graph and flow based security telemetry,

    C. Redino, D. Nandakumar, R. Schiller, K. Choi, A. Rahman, E. Bowen, A. Shaha, J. Nehila, and M. Weeks, “Zero day threat detection using graph and flow based security telemetry,” in 2022 International Conference on Computing, Communication, and Intelligent Systems (ICCCIS). IE...

    2022

  29. [37]

    A scalable approach to internet of things and industrial internet of things security: Evaluating adaptive self-adjusting memory k-nearest neighbor for zero-day attack detection,

    P . R. Agbedanu, S. J. Yang, R. Musabe, I. Gatare, and J. Rwigema, “A scalable approach to internet of things and industrial internet of things security: Evaluating adaptive self-adjusting memory k-nearest neighbor for zero-day attack detection,” Sensors, vol. 25, no. 1, 2025....

    2025

  30. [38]

    An adversarial approach for intrusion detection using hybrid deep learning model,

    M. Asaduzzaman and M. M. Rahman, “An adversarial approach for intrusion detection using hybrid deep learning model,” in2022 International Conference on Information TechnologyResearch and Innovation (ICITRI). IEEE, 2022, pp. 18–23

    2022

  31. [39]

    Image-based zero-day malware detection in iomt devices: A hybrid ai-enabled method,

    Z. He and H. Sayadi, “Image-based zero-day malware detection in iomt devices: A hybrid ai-enabled method,” in 2023 24th International Symposium on Quality Electronic Design (ISQED). IEEE, 2023, pp. 1–8

    2023

  32. [40]

    Zero-day attacks: Review of the meth- ods used based on intrusion detection and prevention systems,

    A. Armijos and E. Cuenca, “Zero-day attacks: Review of the meth- ods used based on intrusion detection and prevention systems,” in 2023 IEEE Colombian Caribbean Conference (C3). IEEE, 2023, pp. 1–6

    2023

  33. [41]

    Hms-ids: Threat intelligence integration for zero-day exploits and advanced persistent threats in iiot,

    K. Saurabh, V . Sharma, U. Singh, R. Khondoker, R. Vyas, and O. Vyas, “Hms-ids: Threat intelligence integration for zero-day exploits and advanced persistent threats in iiot,” Arabian Journal for Science and Engineering, vol. 50, no. 2, pp. 1307–1327, 2025

    2025

  34. [42]

    Towards detection of zero-day botnet attack in iot networks using fed- erated learning,

    J. Zhang, S. Liang, F. Ye, R. Q. Hu, and Y. Qian, “Towards detection of zero-day botnet attack in iot networks using fed- erated learning,” in ICC 2023-IEEE International Conference on Communications. IEEE, 2023, pp. 7–12

    2023

  35. [43]

    A zero-day container attack detec- tion based on ensemble machine learning,

    S. Guo, T. Sivanthi, P . Sommer, M. Kabir-Querrec, N. Coppik, E. Mudgal, and A. Rossotti, “A zero-day container attack detec- tion based on ensemble machine learning,” in 2023 IEEE 28th International Conference on Emerging Technologies and Factory Automation (ETFA). IEEE, 2023...

    2023

  36. [44]

    Zero-day threats detection for critical infrastructures,

    M. Nkongolo and M. Tokmak, “Zero-day threats detection for critical infrastructures,” in Annual Conference of South African Institute of Computer Scientists and Information Technologists. Springer, 2023, pp. 32–47

    2023

  37. [45]

    A deep learning ensemble approach to detecting unknown network attacks,

    R. Ahmad, I. Alsmadi, W. Alhamdani, and L. Tawalbeh, “A deep learning ensemble approach to detecting unknown network attacks,” Journal of Information Security and Applications, vol. 67, p. 103196, 2022

    2022

  38. [46]

    Automated iot device fingerprint- ing through encrypted stream classification,

    J. Sun, K. Sun, and C. Shenefiel, “Automated iot device fingerprint- ing through encrypted stream classification,” in SecureComm, 2019

    2019

  39. [47]

    Iot-keeper: Detecting malicious iot network activity using online traffic anal- ysis at the edge,

    I. Hafeez, M. Antikainen, A. Y. Ding, and S. Tarkoma, “Iot-keeper: Detecting malicious iot network activity using online traffic anal- ysis at the edge,” IEEE TNSM, vol. 17, no. 1, pp. 45–59, 2020

    2020

  40. [48]

    Estimating the support of a high-dimensional distri- bution,

    B. Scholkopf, J. C. Platt, J. Shawe-Taylor, A. J. Smola, and R. C. Williamson, “Estimating the support of a high-dimensional distri- bution,” Neural computation, vol. 13, no. 7, pp. 1443–1471, 2001

    2001

  41. [49]

    Toward su- pervised anomaly detection,

    N. Gornitz, M. Kloft, K. Rieck, and U. Brefeld, “Toward su- pervised anomaly detection,” in Proceedings of the 20th ACM SIGKDD international conference on Knowledge discovery and data mining, 2013, pp. 1037–1046

    2013

  42. [50]

    Isolation forest,

    F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in 2008 Eighth IEEE International Conference on Data Mining. IEEE, 2008, pp. 413–422

    2008

  43. [51]

    Deep one- class classification,

    L. Ruff, R. Vandermeulen, N. Goernitz, L. Deecke, S. A. Siddiqui, A. Binder, E. Muller, and M. Kloft, “Deep one- class classification,” in Proceedings of the 35th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, J. Dy and A. Krause, ...

    2018

  44. [52]

    An efficient one-class svm for anomaly detection in the internet of things,

    K. Yang, S. Kpotufe, and N. Feamster, “An efficient one-class svm for anomaly detection in the internet of things,” arXiv preprint arXiv:2104.11146, 2021

    2021 arXiv

  45. [53]

    Anomaly detection using unsupervised machine learning algorithms: A simulation study,

    E. F. Agyemang, “Anomaly detection using unsupervised machine learning algorithms: A simulation study,” Scientific African, 2024. [Online]. Available: https://www.sciencedirect. com/science/article/pii/S2468227624003284

    2024

  46. [54]

    Deep anomaly detection for time-series data in indus- trial iot: A communication-efficient on-device federated learning approach,

    Y. Liu, S. Garg, J. Nie, Y. Zhang, Z. Xiong, J. Kang, and M. S. Hossain, “Deep anomaly detection for time-series data in indus- trial iot: A communication-efficient on-device federated learning approach,” IEEE Internet of Things Journal, 2020

    2020

  47. [55]

    Isolation forest,

    F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in 2008 eighth ieee international conference on data mining. IEEE, 2008, pp. 413–422

    2008

  48. [56]

    Sparse random projection isolation forest for outlier detection,

    X. Tan, J. Yang, and S. Rahardja, “Sparse random projection isolation forest for outlier detection,” Pattern Recognition Letters, vol. 163, pp. 65–73, 2022

    2022

  49. [57]

    Zero-day guardian: A dual model enabled federated learning framework for handling zero-day attacks in 5g enabled iiot,

    P . Verma, N. Bharot, J. G. Breslin, D. O’Shea, A. Vidyarthi, and D. Gupta, “Zero-day guardian: A dual model enabled federated learning framework for handling zero-day attacks in 5g enabled iiot,” IEEE Transactions on Consumer Electronics, vol. 70, no. 1, pp. 3856–3866, 2023

    2023

  50. [58]

    Learning and evaluating representations for deep one-class classification,

    K. Sohn, C.-L. Li, J. Yoon, M. Jin, and T. Pfister, “Learning and evaluating representations for deep one-class classification,” 2021. [Online]. Available: https://arxiv.org/abs/2011.02578

    2021 arXiv

  51. [59]

    I always feel like somebody’s sensing me! a framework to detect, identify, and localize clandestine wireless sensors,

    A. D. Singh, L. Garcia, J. Noor, and M. Srivastava, “I always feel like somebody’s sensing me! a framework to detect, identify, and localize clandestine wireless sensors,” in USENIX Security, 2021, pp. 1829–1846

    2021

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.